CYBERSECURITYTRACKER
Permanent story citation

China-Linked Hackers Exploit PHP2Shell to Root Firewalls

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 11589

As cited

Copy frozen at (site build).

vulnerabilities

China-Linked Hackers Exploit PHP2Shell to Root Firewalls

China-linked attackers exploited PHP2Shell and Fragnesia vulnerabilities in a chain to compromise two servers belonging to a US government-affiliated organization. The attackers achieved root-level access to firewalls through this coordinated exploit technique.

Why it matters: US government agencies and contractors must patch PHP2Shell and Fragnesia immediately and audit firewall logs for signs of compromise, as state-sponsored actors are actively chaining these exploits for persistent access.

Source published
First seen by Cybersecurity Tracker

Source attribution

Correction

Correction recorded as of .

vulnerabilities

China-Linked Hackers Exploit PHP2Shell to Root Firewalls

China-linked attackers exploited PHP2Shell and Fragnesia vulnerabilities in a chain to compromise two servers belonging to a US government-affiliated organization. The attackers achieved root-level access to firewalls through this coordinated exploit technique.

Why it matters: US government agencies and contractors must patch PHP2Shell and Fragnesia immediately and audit firewall logs for signs of compromise, as state-sponsored actors are actively chaining these exploits for persistent access.

Source published
First seen by Cybersecurity Tracker

Source attribution

Correction

Correction recorded as of .

vulnerabilities

China-Linked Hackers Exploit PHP2Shell to Root Firewalls

China-linked attackers exploited PHP2Shell and Fragnesia vulnerabilities in a chain to compromise two servers belonging to a US government-affiliated organization. The attackers achieved root-level access to firewalls through this coordinated exploit technique.

Why it matters: US government agencies and contractors must patch PHP2Shell and Fragnesia immediately and audit firewall logs for signs of compromise, as state-sponsored actors are actively chaining these exploits for persistent access.

VendorsPalo Alto Networks
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary